Kali Linux persistence mount failure and default encryption decision

Direct Answers

1. Does the persistence hook validate persistence.conf syntax before mounting? No. The live-boot initramfs hook (/usr/share/initramfs-tools/scripts/live-bottom/25persistence) attempts to mount the partition labeled persistence and then reads persistence.conf. A malformed file causes a silent mount failure or drops you to an emergency shell; there is no pre-mount syntax check.
2. Will Kali adopt a default encryption profile for persistent storage? No public roadmap or accepted proposal exists. Upstream live-boot (Debian) has not added one, and Kali’s live-build profiles continue to treat LUKS persistence as an advanced, user-configured option.
3. Does the missing cryptsetup dependency confirm encrypted persistence is opt-in only? Yes. kali-linux-default deliberately omits cryptsetup to keep the default ISO small and avoid a passphrase prompt on boot, aligning with Kali’s “run from RAM” and forensic use-cases. Encrypted persistence requires manual installation of cryptsetup and an explicit luks entry in persistence.conf.

Confirmed Behavior (Late 2026)

• Persistence is enabled only when a partition labeled persistence exists and persistence.conf is present.
• Forensic boot parameter (forensic) disables all persistence mounts.
• kali-linux-default package list (kali-config/variant-default/package-lists/kali-linux-default.list.chroot) does not include cryptsetup.
• No Kali-specific live-boot patches add persistence.conf validation or a default LUKS profile.

Practical Verification Steps

1. Check the metapackage:

   apt show kali-linux-default | grep -i cryptsetup

   (should return nothing).
2. Inspect the hook:

   cat /usr/share/initramfs-tools/scripts/live-bottom/25persistence

   — look for any validation logic before the mount call.
3. Test a bad config: Create a persistence labeled partition with an invalid persistence.conf (e.g., missing / union line), boot the live ISO, and observe whether the hook reports a syntax error or drops to an emergency shell.

One Diagnostic Detail That Changes the Recommendation

If you are building a custom live-build image and have added cryptsetup to your package list, the default behavior for that build changes: the hook will find cryptsetup binaries and honor a luks line in persistence.conf. In that case, verify your custom package-lists and re-run the bad-config test above.